The Custom Twitter Feeds – A Tweets Widget or X Feed Widget WordPress plugin suffers from a CSRF vulnerability (CWE-352) due to improper nonce validation on the ctf_clear_cache_admin() function. This flaw enables attackers to force an administrator to reset the plugin cache through a crafted request without authentication. The vulnerability affects all versions up to and including 2.2.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or official fix information is currently available, and no exploits are known in the wild.

An attacker can cause an administrator to unknowingly reset the plugin cache by exploiting the CSRF vulnerability. This results in limited integrity impact on the plugin's cache state but does not affect confidentiality or availability. The vulnerability requires user interaction (administrator clicking a crafted link) and does not require authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking on untrusted links and consider restricting administrative access or implementing additional CSRF protections at the site level.